Over the last decade or so, malicious software has become a pervasive problem for Internet users as most computers include software vulnerabilities that are subject to attack. For instance, over the past few years, more and more vulnerabilities are being discovered in software that is loaded onto a networked computer or other electronic device. While some vulnerabilities may be addressed through software patches (e.g., to close operating system “OS” vulnerabilities), electronic devices will continue to be targeted by exploits in efforts to acquire sensitive information or adversely affect operations of various enterprises.
In general, an exploit is executable code or other information that attempts to take advantage of a vulnerability by adversely influencing or attacking normal operations of a targeted electronic device. As an illustrative example, a Portable Execution Format (PDF) file may be infected with an exploit that is activated upon execution (opening) of the PDF file and takes advantage of a vulnerability associated with particular version or versions of Acrobat® Reader or another PDF reader application. This type of malicious attack may be designed to control operations of the targeted electronic device, which may include secretive transmission of stored sensitive information.
Currently, security devices may be implemented with a conventional exploit detection scheme that includes virtual machines (VMs) configured to process incoming objects in which the resultant behaviors are monitored during such processing. These “behaviors” may include expected behaviors by the VMs as well as unexpected (anomalous) behaviors such as communication-based anomalies or execution-based anomalies that may alter the functionality of a computer.
More specifically, for this conventional exploit detection scheme, the VMs are configured with general software profiles that are pre-selected in order to widely test different OS and application types commonly used by computers. For instance, general software profiles may be selected to virtualize a particular and widely adopted operating environment for testing purposes. While general software profiles are normally selected to test popular software configurations, these profiles normally differ, and in some cases substantially differ, from the actual operating states of computers currently deployed on a network. Hence, the conventional exploit detection scheme may produce false negatives as many exploits are not captured due to the generalization of the software profiles.
Additionally, once a computer becomes “infected” (e.g., an exploit now resides within internal storage of the computer), conventional remediation techniques are unable to be conducted within minutes of infection. Rather, such remediation may take hours or even days to occur and may be labor intensive.
It is well known that conventional remediation techniques within an enterprise are arduous and time consuming. For example, the infected computer would need to be physically delivered to the information technology (IT) department for analysis or the infected computer would be placed into an non-operational state until an IT member is available to run diagnostics. Hence, conventional remediation techniques are slow and may adversely affect productivity of the employee having the infected computer.